dsh-remote-plugin 0.6.26 → 0.7.0-rc.1

package/index.mjs

@@ -12,6 +12,7 @@ import net from 'node:net'
 import { homedir, hostname, networkInterfaces } from 'node:os'
 import { dirname, extname, normalize, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { createPluginCenter } from './plugin-center.mjs'
 
 export const name = 'dsh-remote'
 export const inject = ['webServer', 'commands', 'agents', 'connection']
@@ -618,6 +619,17 @@ async function resolveFile(pathname) {
 
 async function serveStatic(req, res, ctx) {
   const pathname = new URL(req.url ?? '/', 'http://x').pathname
+  if (pathname.startsWith(`${MOUNT}/api/plugins/`)) {
+    if (!remoteCommandAuthorized(req)) return sendJson(res, 401, { ok: false, message: 'unauthorized' })
+    try {
+      const url = new URL(req.url, 'http://x')
+      const body = req.method === 'POST' ? JSON.parse((await readBody(req, 8192)) || '{}') : {}
+      const result = await pluginCenters.get(ctx).handle(req.method, pathname.slice(`${MOUNT}/api/plugins`.length), body, url.searchParams)
+      return sendJson(res, req.method === 'POST' ? 202 : 200, result)
+    } catch (error) {
+      return sendJson(res, error.status || (error instanceof SyntaxError ? 400 : 500), { ok: false, message: error.message || 'Plugin operation failed' })
+    }
+  }
 
   // 无尾斜杠的入口重定向到带斜杠版本:
   // 否则相对资源 styles.css/app.js 会按 URL 规则解析到上级路径 /styles.css,
@@ -941,7 +953,9 @@ async function serveStatic(req, res, ctx) {
   createReadStream(abs).pipe(res)
 }
 
+const pluginCenters = new WeakMap()
 export function apply(ctx) {
+  pluginCenters.set(ctx, createPluginCenter(ctx))
   dshListen = { host: ctx.webServer.host, port: ctx.webServer.port }
   dshConnection = ctx.connection
   ctx.effect(() => ctx.webServer.register({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-plugin",
-  "version": "0.6.26",
+  "version": "0.7.0-rc.1",
   "description": "DSH Remote 官方 bundle 插件：DSH 左侧原生边栏入口 + 右侧抽屉内嵌管理控制台；内置网关随 DSH 自动启停(systemd 独立单元)，抽屉直显令牌与设备监控；网关提供 /fs/* 文件传输端点(列表/断点下载/上传)，配合 Android App 远程操控会话/审批/提问/goal 与文件互传(多服务器测速切换、聊天记录离线缓存)。",
   "type": "module",
   "main": "./index.mjs",
@@ -18,7 +18,8 @@
     "public",
     "apk",
     "cordis.patch.yml",
-    "*.md"
+    "*.md",
+    "plugin-center.mjs"
   ],
   "keywords": [
     "dsh-plugin",

package/plugin-center.mjs

@@ -0,0 +1,246 @@
+/* Profile-scoped plugin management. No shell input, dependencies or client-selected paths. */
+import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync, readdirSync, copyFileSync, unlinkSync, realpathSync } from 'node:fs'
+import { dirname, basename, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { createHash } from 'node:crypto'
+import { spawn } from 'node:child_process'
+
+const REGISTRY = 'https://registry.npmjs.org'
+const SELF = fileURLToPath(import.meta.url)
+const packagePattern = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*(?![\s\S])/
+const versionPattern = /^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?(?![\s\S])/
+const idPattern = /^[a-zA-Z0-9-]{16,80}(?![\s\S])/
+const read = path => JSON.parse(readFileSync(path, 'utf8'))
+function atomic(path, value) {
+  const tmp = path + '.' + process.pid + '.tmp'
+  writeFileSync(tmp, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 })
+  renameSync(tmp, path)
+}
+const fail = (message, status = 400) => Object.assign(new Error(message), { status })
+const protectedPackage = name => name === 'dsh-remote-plugin' || name.startsWith('@deepseek-ai/')
+const revision = path => createHash('sha256').update(readFileSync(path)).digest('hex')
+
+export function detectProfile(ctx, cli = process.argv[1]) {
+  try {
+    const dir = realpathSync(fileURLToPath(ctx.root?.baseUrl || ctx.baseUrl))
+    const manifest = read(join(dir, 'package.json'))
+    if (basename(dirname(dir)) !== 'profiles' || !Array.isArray(manifest.dsh?.profile?.bundles)) return null
+    const name = basename(dir)
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*(?![\s\S])/.test(name)) return null
+    let root = dirname(realpathSync(cli))
+    let found = null
+    for (let i = 0; i < 5; i++, root = dirname(root)) {
+      try { if (read(join(root, 'package.json')).name === '@deepseek-ai/dsh') { found = join(root, 'lib', 'bin.js'); break } } catch {}
+    }
+    return { dir, name, home: dirname(dirname(dir)), cli: found && existsSync(found) ? found : null }
+  } catch { return null }
+}
+
+async function registryJson(path) {
+  const response = await fetch(REGISTRY + path, { signal: AbortSignal.timeout(20000), redirect: 'error' })
+  if (!response.ok) throw fail('npm registry: HTTP ' + response.status, 502)
+  let raw = '', bytes = 0
+  const decoder = new TextDecoder()
+  for await (const chunk of response.body) {
+    bytes += chunk.length
+    if (bytes > 8 * 1024 * 1024) throw fail('Registry response too large', 502)
+    raw += decoder.decode(chunk, { stream: true })
+  }
+  raw += decoder.decode()
+  return JSON.parse(raw)
+}
+
+export async function pluginDetails(name, version = 'latest') {
+  if (!packagePattern.test(name) || !(version === 'latest' || versionPattern.test(version))) throw fail('Invalid package or version')
+  const data = await registryJson('/' + encodeURIComponent(name) + '/' + encodeURIComponent(version))
+  if (data.name !== name || !versionPattern.test(data.version)) throw fail('Invalid registry metadata', 502)
+  return {
+    name, version: data.version, description: String(data.description || ''),
+    bundle: typeof data.dsh?.bundle?.patch === 'string',
+    license: typeof data.license === 'string' ? data.license : '',
+    homepage: typeof data.homepage === 'string' ? data.homepage : '',
+    engines: data.engines || {}, peers: data.peerDependencies || {},
+    protected: protectedPackage(name), source: REGISTRY,
+  }
+}
+
+export function createPluginCenter(ctx, options = {}) {
+  const profile = options.profile === undefined ? detectProfile(ctx) : options.profile
+  const details = options.details || pluginDetails
+  const launch = options.launch || (args => {
+    const child = spawn(process.execPath, [SELF, '--worker', ...args], { detached: true, windowsHide: true, stdio: 'ignore' })
+    return new Promise((resolveLaunch, reject) => {
+      child.once('error', reject)
+      child.once('spawn', () => { child.unref(); resolveLaunch() })
+    })
+  })
+  const manifestPath = profile && join(profile.dir, 'package.json')
+  const initialRevision = profile && revision(manifestPath)
+  const storage = profile && join(profile.dir, '.remote-plugin-center')
+  let submitting = false
+  async function inventory() {
+    let runtime = [], runtimeAvailable = false
+    const loader = ctx.get?.('loader') || ctx.loader
+    if (loader?.entries) {
+      runtime = [...loader.entries()].filter(entry => !entry.options.group).map(entry => ({
+        id: entry.id, name: entry.options.name, enabled: !entry.disabled,
+        phase: ['pending', 'loading', 'active', 'failed', 'disposed', 'unloading'][entry.fiber?.state] || 'inactive',
+      }))
+      runtimeAvailable = true
+    }
+    if (!profile) return { ok: true, writable: false, reason: '无法确认当前 DSH profile；仅显示运行状态。', runtime, runtimeAvailable, items: [], operations: [] }
+    const manifest = read(manifestPath)
+    const bundles = manifest.dsh.profile.bundles
+    const names = [...new Set([...bundles, ...Object.keys(manifest.dependencies || {})])]
+    const items = names.map(name => {
+      let pkg = null
+      if (packagePattern.test(name)) {
+        try { pkg = read(join(profile.dir, 'node_modules', ...name.split('/'), 'package.json')) } catch {}
+      }
+      return { name, version: pkg?.version || '', requested: manifest.dependencies?.[name] || '',
+        enabled: bundles.includes(name), bundle: !!pkg?.dsh?.bundle?.patch || bundles.includes(name),
+        managed: !!manifest.dependencies?.[name] && !protectedPackage(name),
+        description: pkg?.description || '' }
+    })
+    let operations = []
+    if (existsSync(storage)) operations = readdirSync(storage).filter(name => /^job-[a-zA-Z0-9-]+\.json$/.test(name)).map(name => {
+      try { return read(join(storage, name)) } catch { return null }
+    }).filter(Boolean).sort((a, b) => b.startedAt - a.startedAt).slice(0, 20).map(publicJob)
+    return { ok: true, profile: profile.name, revision: revision(manifestPath), writable: !!profile.cli,
+      reason: profile.cli ? '' : '当前启动方式没有可验证的 DSH CLI，管理操作不可用。',
+      pendingRestart: revision(manifestPath) !== initialRevision,
+      busy: submitting || existsSync(join(storage, 'lock.json')), items, runtime, runtimeAvailable, operations }
+  }
+  async function submit(body) {
+    if (!profile?.cli) throw fail('Current DSH profile is read-only', 409)
+    if (!body || typeof body !== 'object' || Array.isArray(body)) throw fail('Invalid operation')
+    const { id, action, name, version } = body
+    if (!idPattern.test(id || '') || !packagePattern.test(name || '') || !['install', 'update', 'remove', 'enable', 'disable'].includes(action)) throw fail('Invalid operation')
+    if (protectedPackage(name)) throw fail('核心插件与 Remote 自身请通过主机维护流程管理', 409)
+    mkdirSync(storage, { recursive: true, mode: 0o700 })
+    const jobPath = join(storage, 'job-' + id + '.json')
+    if (existsSync(jobPath)) {
+      const previous = read(jobPath)
+      if (previous.action !== action || previous.name !== name || previous.version !== (version || '')) throw fail('Operation id already used', 409)
+      return publicJob(previous)
+    }
+    if (submitting) throw fail('另一个插件操作正在准备中', 409)
+    submitting = true
+    try {
+      if (revision(manifestPath) !== body.revision) throw fail('插件列表已变化，请刷新后重试', 409)
+      const manifest = read(manifestPath)
+      const installed = Object.hasOwn(manifest.dependencies || {}, name)
+      if (action === 'install' && installed || action !== 'install' && !installed) throw fail('安装状态已变化，请刷新', 409)
+      if (['install', 'update'].includes(action)) {
+        if (!versionPattern.test(version || '')) throw fail('需要明确的版本号')
+        const metadata = await details(name, version)
+        if (!metadata.bundle) throw fail('该版本未声明 DSH bundle，不能作为插件安装')
+      }
+      if (['enable', 'disable'].includes(action)) {
+        const pkg = read(join(profile.dir, 'node_modules', ...name.split('/'), 'package.json'))
+        if (!pkg.dsh?.bundle?.patch) throw fail('该依赖不是 DSH bundle')
+      }
+      if (revision(manifestPath) !== body.revision) throw fail('插件配置已变化，请刷新', 409)
+      const lock = join(storage, 'lock.json')
+      try { writeFileSync(lock, JSON.stringify({ id }), { flag: 'wx', mode: 0o600 }) }
+      catch (error) { if (error.code === 'EEXIST') throw fail('已有插件任务运行中；请查看操作记录', 409); throw error }
+      const job = { id, action, name, version: version || '', revision: body.revision, profile: profile.name, phase: 'queued', startedAt: Date.now(), log: '', restartRequired: false }
+      try {
+        atomic(jobPath, job)
+        await launch([profile.dir, profile.cli, id])
+      } catch (error) {
+        job.phase = 'failed'; job.message = '无法启动插件任务'; job.endedAt = Date.now()
+        atomic(jobPath, job); unlinkSync(lock); throw error
+      }
+      return publicJob(job)
+    } finally { submitting = false }
+  }
+  async function handle(method, sub, body = {}, query = new URLSearchParams()) {
+    if (method === 'GET' && sub === '/state') return inventory()
+    if (method === 'GET' && sub === '/details') return { ok: true, item: await details(query.get('name') || '', query.get('version') || 'latest') }
+    if (method === 'GET' && sub === '/market') {
+      const q = String(query.get('q') || '').trim()
+      if (q.length > 80) throw fail('Search too long')
+      const offset = Number(query.get('offset') || 0)
+      if (!Number.isInteger(offset) || offset < 0 || offset > 1000) throw fail('Invalid offset')
+      const data = await registryJson('/-/v1/search?text=' + encodeURIComponent('keywords:dsh-plugin ' + q) + '&size=20&from=' + offset)
+      return { ok: true, source: REGISTRY, total: data.total || 0, items: (data.objects || []).map(({ package: p }) => ({ name: p.name, version: p.version, description: p.description || '' })) }
+    }
+    if (method === 'POST' && sub === '/operations') return { ok: true, operation: await submit(body) }
+    throw fail('Unknown plugin endpoint', 404)
+  }
+  return { handle, inventory, submit }
+}
+
+function publicJob(job) {
+  const { id, action, name, version, profile, phase, startedAt, endedAt, log, message, restartRequired } = job
+  return { id, action, name, version, profile, phase, startedAt, endedAt, log, message, restartRequired }
+}
+
+export async function runWorker(dir, cli, id, execute = runCli) {
+  if (!idPattern.test(id || '')) throw fail('Invalid worker id')
+  const storage = join(dir, '.remote-plugin-center')
+  const lock = join(storage, 'lock.json')
+  if (read(lock).id !== id) throw fail('Worker does not own lock')
+  const jobPath = join(storage, 'job-' + id + '.json')
+  const job = read(jobPath)
+  const manifestPath = join(dir, 'package.json')
+  const disabledPath = join(storage, 'disabled.json')
+  let disabled
+  const save = () => atomic(jobPath, job)
+  try {
+    job.phase = 'running'; save()
+    if (job.revision !== revision(manifestPath)) throw fail('任务开始前 profile 已变化，请刷新后重试')
+    disabled = new Set(existsSync(disabledPath) ? read(disabledPath) : [])
+    const backup = join(storage, 'backup-' + id)
+    mkdirSync(backup, { mode: 0o700 })
+    for (const name of ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', 'cordis.patch.yml']) {
+      if (existsSync(join(dir, name))) copyFileSync(join(dir, name), join(backup, name))
+    }
+    if (existsSync(disabledPath)) copyFileSync(disabledPath, join(backup, 'disabled.json'))
+    if (['install', 'update', 'remove'].includes(job.action)) {
+      const args = job.action === 'remove' ? ['remove', job.name, '--ignore-scripts'] : ['add', job.name + '@' + job.version, '--save-exact', '--ignore-scripts', '--registry=' + REGISTRY]
+      await execute(cli, ['plugin', '--profile', basename(dir), ...args], dir, chunk => {
+        job.log = (job.log + chunk.replace(/\x1b\[[0-9;]*m/g, '').replace(/(token|password|authorization)\s*[=:]\s*\S+/gi, '$1=[redacted]')).slice(-12000)
+        save()
+      })
+    }
+    if (job.action === 'disable') disabled.add(job.name)
+    if (job.action === 'enable' || job.action === 'remove') disabled.delete(job.name)
+    const manifest = read(manifestPath)
+    manifest.dsh.profile.bundles = manifest.dsh.profile.bundles.filter(name => !disabled.has(name))
+    if (job.action === 'enable' && !manifest.dsh.profile.bundles.includes(job.name)) manifest.dsh.profile.bundles.push(job.name)
+    atomic(manifestPath, manifest)
+    atomic(disabledPath, [...disabled])
+    const installed = Object.hasOwn(manifest.dependencies || {}, job.name)
+    if (job.action === 'remove' ? installed : !installed) throw fail('操作后依赖状态与预期不符')
+    if (['install', 'update'].includes(job.action)) {
+      const pkg = read(join(dir, 'node_modules', ...job.name.split('/'), 'package.json'))
+      if (pkg.version !== job.version || !pkg.dsh?.bundle?.patch) throw fail('安装后的包版本或 bundle 校验失败')
+    }
+    job.phase = 'complete'; job.restartRequired = true
+    job.message = '配置已保存；重启 DSH 后生效。安装脚本未执行。'
+  } catch (error) {
+    job.phase = 'failed'; job.message = String(error.message || error)
+    // A failed package manager may have changed files. Never claim rollback.
+    job.restartRequired = true
+  } finally {
+    job.endedAt = Date.now(); save()
+    if (read(lock).id === id) unlinkSync(lock)
+  }
+}
+
+function runCli(cli, args, dir, output) {
+  return new Promise((resolveRun, reject) => {
+    const env = { ...process.env, DSH_HOME: dirname(dirname(dir)), npm_config_ignore_scripts: 'true' }
+    const child = spawn(process.execPath, [cli, ...args], { cwd: dir, env, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] })
+    child.stdout.on('data', chunk => output(chunk.toString()))
+    child.stderr.on('data', chunk => output(chunk.toString()))
+    child.once('error', reject)
+    child.once('close', code => code === 0 ? resolveRun() : reject(fail('DSH 插件命令失败，退出码 ' + code)))
+  })
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === SELF && process.argv[2] === '--worker') {
+  await runWorker(process.argv[3], process.argv[4], process.argv[5])
+}

package/public/app.js

@@ -7305,3 +7305,14 @@ async function boot() {
 }
 
 document.addEventListener('DOMContentLoaded', boot)
+
+// Capture the connection so switching servers cannot redirect a plugin mutation.
+document.getElementById('btn-plugin-center')?.addEventListener('click', () => {
+  const server = state.server || ''
+  const token = state.token
+  window.DshPluginCenter.open({
+    url: path => server + path,
+    headers: { authorization: 'Bearer ' + token, 'x-dsh-remote-client': 'web', ...clientIdHeaders() },
+    valid: () => (state.server || '') === server && state.token === token,
+  })
+})

package/public/desktop/desktop.html

@@ -7,6 +7,7 @@
   <script>/* 首帧前应用皮肤 */ (function(){try{var t=localStorage.getItem('dshTheme');if(t!=='default'&&t!=='dark'&&t!=='light'&&t!=='neutral'&&t!=='mono'){t=window.matchMedia('(prefers-color-scheme: light)').matches?'light':'default'}document.documentElement.setAttribute('data-theme',t)}catch(e){}})()</script>
   <link rel="stylesheet" href="../theme-vars.css">
   <link rel="stylesheet" href="desktop.css">
+  <link rel="stylesheet" href="../plugin-center.css">
 </head>
 <body>
   <div class="ds-app" id="ds-app">
@@ -218,6 +219,7 @@
         <section id="view-settings" class="ds-view hidden">
           <div class="ds-section-label" data-i18n="ds.settings">设置</div>
           <div id="settings-home">
+          <button type="button" id="btn-plugin-center" class="ds-setting-row ds-setting-link"><span>插件中心 · 已安装 / 发现插件</span><span>›</span></button>
             <div class="ds-settings">
               <button type="button" class="ds-setting-row ds-setting-link" data-settings-group="general">
                 <div><div class="ds-setting-name" data-i18n="ds.groupGeneral">通用</div><div class="ds-setting-desc" data-i18n="ds.groupGeneralDesc">工具调用、预设提示词</div></div>
@@ -709,6 +711,7 @@
   <script src="../vendor/gsap/gsap.min.js"></script>
   <script src="../motion.js"></script>
   <script type="module" src="../morphicons-init.js"></script>
+  <script src="../plugin-center.js"></script>
   <script src="desktop.js"></script>
 </body>
 </html>

package/public/desktop/desktop.js

@@ -3518,3 +3518,14 @@ async function start() {
 }
 
 start()
+
+// Capture the connection so switching servers cannot redirect a plugin mutation.
+document.getElementById('btn-plugin-center')?.addEventListener('click', () => {
+  const server = state.server || ''
+  const token = state.token
+  window.DshPluginCenter.open({
+    url: path => server + path,
+    headers: { authorization: 'Bearer ' + token, 'x-dsh-remote-client': 'web', ...clientIdHeaders() },
+    valid: () => (state.server || '') === server && state.token === token,
+  })
+})

package/public/index.html

@@ -13,6 +13,7 @@
   <link rel="icon" href="icon.svg" type="image/svg+xml">
   <link rel="stylesheet" href="styles.css">
   <link rel="stylesheet" href="genui.css">
+  <link rel="stylesheet" href="plugin-center.css">
 </head>
 <body>
   <header class="topbar">
@@ -293,6 +294,7 @@
     <!-- 设置 -->
     <section id="view-settings" class="view hidden">
       <div id="settings-home">
+          <button type="button" id="btn-plugin-center" class="setting-row setting-link"><span>插件中心 · 已安装 / 发现插件</span></button>
         <div class="settings-group">
           <button type="button" class="setting-row setting-link" data-settings-group="general">
             <div><div class="setting-name" data-i18n="settings.groupGeneral">通用</div><div class="setting-desc" data-i18n="settings.groupGeneralDesc">显示工具调用、预设提示词</div></div>
@@ -1379,6 +1381,7 @@
   <script src="vendor/gsap/gsap.min.js"></script>
   <script src="motion.js"></script>
   <script type="module" src="morphicons-init.js"></script>
+  <script src="plugin-center.js"></script>
   <script src="app.js"></script>
 </body>
 </html>

package/public/plugin-center.css

@@ -0,0 +1 @@
+.pc-dialog{width:min(860px,94vw);max-height:88dvh;box-sizing:border-box;border:1px solid #7775;border-radius:18px;background:var(--dsr-panel,#171b24);color:var(--dsr-text,#eee);padding:22px;overflow:auto}.pc-dialog::backdrop{background:#0009}.pc-heading,.pc-actions{display:flex;align-items:center;gap:10px;flex-wrap:wrap}.pc-heading{justify-content:space-between}.pc-dialog h2,.pc-dialog h3{margin:0}.pc-dialog h3{font-size:16px;overflow-wrap:anywhere}.pc-dialog p{line-height:1.6;overflow-wrap:anywhere}.pc-dialog button,.pc-dialog input{font:inherit;border:1px solid #8886;border-radius:9px;padding:9px 12px;background:transparent;color:inherit}.pc-dialog button{cursor:pointer}.pc-dialog button:disabled{opacity:.4;cursor:not-allowed}.pc-dialog button:focus-visible,.pc-dialog input:focus-visible{outline:2px solid #6e9dff;outline-offset:2px}.pc-dialog input{max-width:100%;box-sizing:border-box;min-width:0}.pc-market-tools:not([hidden]){display:flex;gap:8px;flex-wrap:wrap;margin-top:14px}.pc-search{flex:1}.pc-card{border:1px solid #8884;border-radius:12px;padding:16px;margin:12px 0}.pc-card>button,.pc-card>input,.pc-card>a{margin:8px 8px 0 0}.pc-dialog a{color:var(--dsr-accent-strong)}.pc-dialog details{padding:10px 0}.pc-dialog summary{cursor:pointer;overflow-wrap:anywhere}.pc-dialog pre{white-space:pre-wrap;overflow-wrap:anywhere;max-height:240px;overflow:auto;font-size:12px}.pc-message{color:var(--dsr-text)}.pc-profile{font-weight:600}.pc-dialog small{opacity:.7}@media(max-width:520px){.pc-dialog{padding:15px}.pc-dialog button{min-height:42px}.pc-actions>*{flex:1}.pc-card{padding:12px}}

package/public/plugin-center.js

@@ -0,0 +1,181 @@
+/* Shared mobile/desktop plugin center. Credentials stay in the parent connection. */
+'use strict';
+window.DshPluginCenter = (() => {
+  let dialog, connection, snapshot, timer, generation = 0, pending = false, tab = 'installed', offset = 0, searchSequence = 0, detailSequence = 0
+  let renderedInstalled = '', renderedJobs = ''
+  const labels = { install: '安装', update: '更新', remove: '卸载', enable: '启用', disable: '停用', queued: '等待执行', running: '执行中', complete: '已完成', failed: '失败' }
+  function node(tag, text, className) {
+    const el = document.createElement(tag)
+    if (text != null) el.textContent = text
+    if (className) el.className = className
+    return el
+  }
+  function button(text, action) {
+    const el = node('button', text)
+    el.type = 'button'; el.addEventListener('click', () => {
+      const current = generation
+      Promise.resolve().then(action).catch(error => { if (current === generation) message(error.message) })
+    })
+    return el
+  }
+  function message(text) { dialog.querySelector('.pc-message').textContent = text }
+  async function api(path, body) {
+    if (!connection.valid()) throw new Error('连接已切换，请关闭后重新打开插件中心')
+    const current = generation
+    const response = await fetch(connection.url('/remote/api/plugins' + path), {
+      method: body ? 'POST' : 'GET', headers: { ...connection.headers, 'content-type': 'application/json' },
+      ...(body ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.timeout(30000),
+    })
+    if (current !== generation || !dialog.open || !connection.valid()) throw new Error('连接已切换，请重新打开插件中心')
+    let data
+    try { data = await response.json() } catch { throw new Error('当前服务器不支持插件中心，请升级主机端 Remote 插件') }
+    if (current !== generation || !dialog.open || !connection.valid()) throw new Error('连接已切换，请重新打开插件中心')
+    if (!response.ok || data.ok === false) throw new Error(data.message || '请求失败：HTTP ' + response.status)
+    return data
+  }
+  function card(name, description) {
+    const el = node('article', null, 'pc-card')
+    el.append(node('h3', name), node('p', description))
+    return el
+  }
+  function renderInstalled() {
+    const list = dialog.querySelector('.pc-list'); list.replaceChildren()
+    if (!snapshot.items.length) list.append(node('p', '暂无可管理插件'))
+    for (const item of snapshot.items) {
+      const el = card(item.name, item.description)
+      el.append(node('p', (item.version || item.requested || '内置') + ' · ' + (item.enabled ? '配置启用' : '配置停用') + (snapshot.pendingRestart ? ' · 待重启' : '')))
+      if (item.managed && snapshot.writable) {
+        const actions = node('div', null, 'pc-actions')
+        actions.append(button('查看更新', () => showDetails(item.name)))
+        if (item.bundle) actions.append(button(item.enabled ? '停用' : '启用', () => mutate(item.enabled ? 'disable' : 'enable', item.name)))
+        actions.append(button('卸载', () => mutate('remove', item.name)))
+        for (const action of actions.children) action.disabled = pending || snapshot.busy
+        el.append(actions)
+      } else el.append(node('small', '内置、核心或只读插件'))
+      list.append(el)
+    }
+    const runtime = node('details')
+    runtime.append(node('summary', '当前进程实际加载状态 (' + snapshot.runtime.length + ')'))
+    if (!snapshot.runtimeAvailable) runtime.append(node('p', '此 DSH 版本未提供加载状态'))
+    for (const entry of snapshot.runtime) runtime.append(node('p', entry.name + ' · ' + entry.phase + (entry.enabled ? '' : ' · disabled')))
+    list.append(runtime)
+  }
+  async function refresh() {
+    snapshot = await api('/state')
+    dialog.querySelector('.pc-profile').textContent = snapshot.profile ? '当前环境：' + snapshot.profile : '当前环境无法识别'
+    dialog.querySelector('.pc-status').textContent = snapshot.reason || (snapshot.pendingRestart ? '插件配置已变更，重启 DSH 后生效。' : '安装到当前连接的 DSH 主机。')
+    const installedKey = JSON.stringify([snapshot.items, snapshot.runtime, snapshot.pendingRestart, snapshot.busy, snapshot.writable, pending])
+    if (tab === 'installed' && installedKey !== renderedInstalled) { renderInstalled(); renderedInstalled = installedKey }
+    const jobsKey = JSON.stringify(snapshot.operations)
+    if (jobsKey === renderedJobs) return
+    renderedJobs = jobsKey
+    const jobs = dialog.querySelector('.pc-jobs')
+    const expanded = new Set([...jobs.querySelectorAll('details[open]')].map(el => el.dataset.id))
+    jobs.replaceChildren()
+    for (const job of snapshot.operations) {
+      const el = node('details')
+      el.dataset.id = job.id; el.open = expanded.has(job.id)
+      el.append(node('summary', (labels[job.action] || job.action) + ' ' + job.name + (job.version ? '@' + job.version : '') + ' · ' + (labels[job.phase] || job.phase)))
+      el.append(node('small', new Date(job.startedAt).toLocaleString()))
+      el.append(node('p', job.message || '任务在主机端执行，可关闭窗口后回来查看。'))
+      if (job.log) el.append(node('pre', job.log))
+      jobs.append(el)
+    }
+  }
+  async function search() {
+    const sequence = ++searchSequence
+    const q = dialog.querySelector('.pc-search').value.trim()
+    const list = dialog.querySelector('.pc-list'); list.replaceChildren(node('p', '正在查询 npm 插件目录…'))
+    const data = await api('/market?q=' + encodeURIComponent(q) + '&offset=' + offset)
+    if (tab !== 'market' || sequence !== searchSequence) return
+    list.replaceChildren(node('p', '来源：npm · 安装前校验 DSH bundle。目录收录不代表安全或兼容性审核。'))
+    if (!data.items.length) list.append(node('p', '没有找到插件；也可直接输入完整 npm 包名后查看详情。'))
+    for (const item of data.items) {
+      const el = card(item.name, item.description)
+      el.append(node('small', item.version), button('查看详情', () => showDetails(item.name)))
+      list.append(el)
+    }
+    if (offset > 0) list.append(button('上一页', () => { offset -= 20; return search() }))
+    if (offset + 20 < data.total) list.append(button('下一页', () => { offset += 20; return search() }))
+  }
+  async function showDetails(name, version) {
+    const sequence = ++detailSequence
+    const { item } = await api('/details?name=' + encodeURIComponent(name) + (version ? '&version=' + encodeURIComponent(version) : ''))
+    if (sequence !== detailSequence) return
+    const area = dialog.querySelector('.pc-detail'); area.replaceChildren()
+    const el = card(item.name + ' @ ' + item.version, item.description)
+    el.append(node('p', '许可证：' + (item.license || '未声明') + ' · ' + (item.bundle ? 'DSH bundle' : '未声明 DSH bundle')))
+    el.append(node('p', '运行要求：' + JSON.stringify(item.engines) + '；依赖要求：' + JSON.stringify(item.peers)))
+    el.append(node('p', '插件代码将在 DSH 主机运行。安装脚本默认禁用；需要额外配置的插件须在主机完成配置。'))
+    if (/^https:\/\//.test(item.homepage)) {
+      const link = node('a', '项目主页'); link.href = item.homepage; link.target = '_blank'; link.rel = 'noopener noreferrer'; el.append(link)
+    }
+    const input = node('input'); input.value = item.version; input.setAttribute('aria-label', '插件版本'); input.placeholder = '指定版本，如 1.2.3'
+    el.append(input, button('查看此版本', () => showDetails(name, input.value.trim())))
+    const installed = snapshot?.items.find(row => row.name === name)
+    const action = installed ? 'update' : 'install'
+    const install = button((labels[action]) + ' ' + item.version, () => mutate(action, name, item.version))
+    install.disabled = !item.bundle || item.protected || !snapshot?.writable || snapshot.busy || pending || installed?.version === item.version
+    el.append(install, button('关闭详情', () => area.replaceChildren()))
+    area.append(el); area.scrollIntoView({ block: 'nearest' })
+  }
+  async function mutate(action, name, version) {
+    if (pending) return
+    // LAN HTTP is not a secure context; an idempotency key does not need WebCrypto.
+    const id = globalThis.crypto?.randomUUID?.() || `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}-${Math.random().toString(36).slice(2)}`
+    const body = { id, action, name, ...(version ? { version } : {}), revision: snapshot.revision }
+    const area = dialog.querySelector('.pc-detail')
+    const review = card('确认' + labels[action], name + (version ? '@' + version : ''))
+    review.append(node('p', '目标环境：' + snapshot.profile + '。配置修改后需要重启 DSH；不会自动重启。'))
+    review.append(button('确认' + labels[action], () => executeMutation(body)), button('取消', () => area.replaceChildren()))
+    area.replaceChildren(review); area.scrollIntoView({ block: 'nearest' })
+  }
+  async function executeMutation(body) {
+    if (pending) return
+    const current = generation
+    pending = true
+    try {
+      message('正在提交…')
+      await api('/operations', body)
+      message('已受理，可在操作记录查看结果。')
+      dialog.querySelector('.pc-detail').replaceChildren()
+    } catch (error) {
+      if (current !== generation) return
+      message(error.message + '；请先查看操作记录，避免重复提交。')
+      const retry = button('重试同一请求', () => executeMutation(body))
+      dialog.querySelector('.pc-detail').replaceChildren(retry)
+    } finally { if (current === generation) { pending = false; await refresh() } }
+  }
+  async function open(config) {
+    if (!dialog) {
+      dialog = node('dialog', null, 'pc-dialog')
+      const heading = node('div', null, 'pc-heading'); heading.append(node('h2', '插件中心'), button('关闭', () => dialog.close()))
+      const toolbar = node('div', null, 'pc-actions')
+      toolbar.append(button('已安装', () => { tab = 'installed'; renderedInstalled = ''; dialog.querySelector('.pc-market-tools').hidden = true; return refresh() }), button('发现插件', () => { tab = 'market'; offset = 0; dialog.querySelector('.pc-market-tools').hidden = false; return search() }), button('刷新状态', refresh))
+      const market = node('form', null, 'pc-market-tools'); market.hidden = true
+      const input = node('input', null, 'pc-search'); input.placeholder = '搜索插件或输入完整 npm 包名'; input.maxLength = 80; input.setAttribute('aria-label', '搜索插件或 npm 包名')
+      market.append(input, button('搜索', () => { offset = 0; return search() }), button('按包名查看', () => showDetails(input.value.trim())))
+      market.addEventListener('submit', event => { event.preventDefault(); offset = 0; search().catch(error => message(error.message)) })
+      const jobs = node('details'); jobs.append(node('summary', '操作记录'), node('div', null, 'pc-jobs'))
+      const alert = node('p', null, 'pc-message'); alert.setAttribute('role', 'status')
+      dialog.append(heading, node('p', null, 'pc-profile'), node('p', null, 'pc-status'), toolbar, market, alert, node('div', null, 'pc-detail'), node('div', null, 'pc-list'), jobs)
+      dialog.addEventListener('close', () => { generation++; clearTimeout(timer) })
+      document.body.append(dialog)
+    }
+    generation++; searchSequence++; detailSequence++; connection = config; tab = 'installed'; pending = false; snapshot = null
+    const current = generation
+    renderedInstalled = ''; renderedJobs = ''
+    dialog.querySelector('.pc-market-tools').hidden = true
+    dialog.querySelector('.pc-detail').replaceChildren(); dialog.querySelector('.pc-list').replaceChildren(); dialog.querySelector('.pc-jobs').replaceChildren()
+    dialog.showModal(); message('正在读取插件状态…')
+    try { await refresh(); message('') } catch (error) { if (current === generation) message(error.message) }
+    if (current !== generation) return
+    async function poll() {
+      if (!dialog.open || current !== generation) return
+      try { await refresh() } catch (error) { if (current === generation) message(error.message) }
+      if (dialog.open && current === generation) timer = setTimeout(poll, 4000)
+    }
+    timer = setTimeout(poll, 4000)
+  }
+  return { open }
+})()

package/public/update.json

@@ -1,9 +1,9 @@
 {
-  "version": "0.6.26",
+  "version": "0.7.0-rc.1",
   "apkUrl": "dsh-remote.apk",
-  "sha256": "5b60977e3960d65b1ab60cb9f168835c8de927113738d925881340749122d2aa",
-  "releasedAt": "2026-09-16T16:59:10.029Z",
-  "notes": "0.6.26：修复 DSH 通配监听地址导致的认证与实时连接失败，兼容 IPv6-only；上传覆盖失败保留原文件，避免并发同名覆盖和续传分片竞争；网关改用认证关闭，避免误杀其他进程；完善 dsh-ui 堆叠柱状图、标签页、表格排序与特殊单元格、趋势线、环形进度、文件树和修改前后预览。已通过 Windows 自动测试与浏览器检查，Linux/Docker 专项实测仍待完成。",
+  "sha256": "5393a9a7866566b63f2f0998ec8ac984600e182c153ee1ee892573405385e63f",
+  "releasedAt": "2026-09-18T23:57:45.705Z",
+  "notes": "0.7.0-rc.1：新增插件中心，支持手机端和桌面端管理当前 DSH profile 的插件，搜索 npm 插件目录、查看详情及安装指定版本；支持更新、卸载、配置启停、任务日志与配置备份。启停需重启 DSH 生效，安装默认禁用脚本。此为测试版，Android 真机与 Linux 使用场景仍待验收。",
   "history": [
     {
       "version": "0.6.26",

package/public/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.6.26"
+  "version": "0.7.0-rc.1"
 }